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FIBRE CHANNEL ADDRESS BLOCKING 

BACKGROUND OF THE INVENTION 

1. Technical Field 

The invention relates to fibre channel computer networks and 
more particularly to apparatus and method for preventing 
unwanted access to data at a target device when an invalid 
source address is detected. 

2. Description of the Prior Art 

Fibre channel is a general name of a new protocol for 
flexible information transfer. The fibre channel provides ai 
high speed transfer of large amounts of information while 
providing an interconnection for various interfaces such as 
central processing units and data storage devices. The fibre 
channel permits the transporting of multiple protocols over a 
common physical interface. The channel protocol refers to a 
peripheral input/output interface to a host computer that 
transports large amounts of data between the host computer and 
the peripheral device such as a data storage system. Data 
transfer is handled in hardware with little or no software 
involvement once an input/output operation begins. A network 
protocol on the other hand usually supports host-to-host 
communication and refers to an input/output interface that 
usually supports many small transactions. Fibre channel 
provides an input/output interface that meets the needs of 
channel protocol and network protocols. 



TU999033 

The fibre channel while increasing the number of devices 
that can be interconnected is unaware of the content or 
meaning of the information being transmitted on the channel. 
The fibre channel also increases the allowable distance 
between devices and increases the transfer rate of the data. 
This becomes a problem when one user wants to protect its 
private data from access from the remainder of the network. 
Many requests for data can be transmitted on a fibre channel 
and many sources of data can be connected to the return path 
of the fibre channel. Thus, unauthorized requests for private 
data can be made from anyone of the multiple requesters 
connected to a fibre channel. It is, therefore, an object of 
the present invention to provide an apparatus and a -method for 
protecting data sources from access by unauthorized • 
requesters. . . y:. : . 

It would be advantageous to provide a network security 
technique that permits fibre channel interconnection to a 
worldwide network while protecting a user's private data from 
access without authorization. 
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SUMMARY OF THE INVENTION 

The invention provides a technique that permits network 
access to a storage device while monitoring the source address of 
the requester to determine whether the requester has been 
authorized to access the data. A blocking device is positioned 
between the fibre channel address target and the fabric switch 
controlling the connection of the source and the target. The 
blocker inspects all incoming frames of data. The blocker checks 
the source and destination addresses. If a frame of data is 
detected that is addressed to an unconfigured source/destination 
address peer, the frame has its data replaced with IDLE 
characters. The source could be a host computer requester with a 
private data storage device being the target. Likewise, the 
source could be the private data storage with the target .being . 
the* host computer of the requester. With this invention,™ ' 
unauthorized data is prevented from being transported along the 
fibre channel while the integrity of the transmission of data is 
maintained by transporting IDLE characters instead of data frames 
of information . 

The invention provides a number of distinct advantages. The 
present invention provides apparatus that is positioned in the 
fibre channel to block either an unauthorized access to private 
data or to prevent the unauthorized access to a user's network 
from external network addressing. The invention is unique in 
that the integrity of the fibre channel is not disturbed since 
the data frames are replaced by IDLE characters and thereby the 
transmission along the fibre channel is not interrupted. In the 
method of the invention, the destination target address is 
compared to an allowed list of addresses. If a valid comparison 
is made, the data frame is passed along the fibre channel. If 
there is no comparison, as would be the case for an unauthorized 
access, the data frames are converted to IDLE characters and 
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transmitted down the fibre channel. The blocking apparatus of 
this invention can be positioned to prevent unauthorized access 
to either a private data source or the entire private user's 
network. 

5 An object of the present invention, therefore, is to provide 

an enhanced fibre channel network. 

Another object of the present invention is to provide a 
means and a process to prevent unauthorized access to data 
through a fibre channel. 
10 Still another object of the present invention is to provide 

apparatus and an article of manufacture that maintains the 
integrity of the fibre channel by replacing the data frames with 

0 IDLE characters and thereby continuing the data flow along the 
iTi . . channel... • . . . . .. 

!I5 ,. ( ..The foregoing, and other objects ,, featiares and advantages of 
the invention will become more apparent to those skilled in the 

01 art after considering the following detailed description in 
connection with the accompanying drawing in which reference 

y numbers designate like parts throughout. 
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BRIEF DESCRIPTION OF THE DRAWINGS 

FIG. 1 is a block diagram of the hardware components and 
interconnection of one illustrative implementation of the 
5 invention; 

FIG. 2 is a block diagram of the hardware components and 
interconnections of a second illustrative implementation of the 
invention; 

FIG. 3 is a block diagram of the apparatus of the invention 
10 as inserted in a fibre channel; 

FIG. 4 is a detailed block diagram of the apparatus of the 
present invention as shown in FIG. 3; and 
\Q FIG. 5 is a flowchart showing a sequence of steps to control 

the unauthorized accessing of data while maintaining the 
0l> integrity of the fibre channel in accordance with the present 
invention. 
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DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 

The invention concerns the address blocking in a fibre 
channel that blocks access by an unauthorized user to 
5 confidential data of a second user in a network. The frames of 
data being transmitted down the fibre channel is inspected 
incoming to the device that is to be protected. In one embodiment 
of the invention, the blocking device is placed between a private 
data storage system and the fibre switch of the user holding the 
10 confidential data in his private storage system. In a second 
embodiment of the invention, the blocking device is placed 
between the fibre switch of the confidential data owner and the 
Q confidential owner's network adapter used to access the fibre 
J"! channel network to the outside world. The blocker includes a 
CH5 comparator that checks the source and 'authorized addresses 
£j thereby permitting access to the owner's private data storage 
IJi only to authorized users. The blocking device also checks the 
^ transmission of data from the private data storage back to the 

S user and again compares the source of authorized addresses. The 

iS 

jZO frames of data in both regulating devices replace the data frame 

=P with IDLE characters. The present invention also includes a 

=0 

method for converting the data frames to IDLE characters 
according to the present invention. For an overview of the fibre 
channel, reference is made to the book entitled, "The Fibre 

25 Channel Bench Reference" by Jeffrey D. Stai, published by the 
ENDL Publications of Saratoga, California and copyrighted 
1996-1999. The book gives an overview of the fibre channel 
arbitrated loop (FCAL) topology and the fabric switching 
configurations used in fibre channels. Further details of the 

30 fibre channels can be obtained from this book and is useful for 
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understanding the present invention. An overview of the FCAL 
topology and the use of the invention as positioned between a 
FCAL target and the interconnection is shown in FIG. 1. 

Referring now to FIG. 1, a FCAL system is used as the 
internal system 10 interconnected with a fabric switch 12. The 
fabric switch 12 is shown connected to two public work stations 
14 and 16 but it should be understood that the showing of two 
does not limit the number of public work stations that can be 
interconnected with a fabric switch. The internal FCAL system 
can include one or more private work stations 18, one or more 
public data storage systems 20, and one or more private data 
storage systems 22. The ports of each of the private workstation 
18, the public data storage 20, and the private data storage 22 
» are interconnected in an ; arbitrated loop represented by the hub 
24. A controller 26 operates and controls the intercorinectivity 
of the different systems in the internal FCAL system by 
controlling the operation of the hub 24. A blocker 30, 
representing the present invention, is shown positioned between 
the hub 24 and the private data storage 22. The blocker 30 
protects unauthorized access to the private data storage 22 of 
the internal FCAL system 10. This could happen, for instance, if 
the public workstation 14, for instance, requests access to the 
private data storage 22 through the fabric switch 12 and into the 
internal FCAL system 10 by virtue of loop connection to the hub 
24. The blocker 3 0 prevents unauthorized access to the private 
data storage system if there is an unauthorized request for 
access outside of the internal FCAL system. The blocker 3 0 
inspects all incoming frames of data, checks the source and 
destination addresses included in the frames of data and prevents 
the access to the private data storage 22 if the user frame is 
detected that is addressed to an unconfigured source/destination 
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addressed pair, the frame is replaced with IDLE characters and, 
therefore, the frame is never transmitted to the private data 
storage 22. A second embodiment in use of the blocker 30 is 
shown in FIG 2 . 

5 Referring now to FIG. 2, an internal FCAL system 100 is 

shown including a private workstation 102, a public data storage 
104 and a private data storage 106 all interconnected to a FCAL 
loop technology in a hub 108. The blocker 30 of the present 
invention is shown positioned between a fabric switch 110 and the 
10 internal FCAL system 100 on an input fibre channel 112. The 

fibre switch 110 is shown interconnected through fibre channels 
to a plurality of public workstations 114. The fabric switch 110 
Q represents an interconnection to many workstations and data 
{f 3 storages all- external to the internal FCAL system 100. In the * 
iJ5 embodiment shown in FIG. 2, the invention disclosed in blocker: 3 0 
£j is shown positioned between the incoming fibre channel 112 from 
IIP the fabric switch 110 and intercepts the frames of data on the 
J* fibre channel directed towards the hub 108. In this embodiment, 
O the invention is positioned between the FCAL target represented 
pp by the internal FCAL system 100 and the fabric switch 110. As in 
*P the first embodiment, the blocker 3 0 inspects all incoming frames 
to the internal FCAL system 100 and checks the source and 
destination addresses included into the data frames on the fibre 
channel 112. Again, if a user data frame is detected by the 
25 blocker 30 on the fibre channel 112 that is addressed to an 

unconfigured source/destination address pair, the data frame is 
replaced with IDLE characters and thereby no access is permitted 
by an unauthorized user of the data whether public or private 
located in the internal FCAL system 100. A block diagram of the 
30 blocker 30 of the embodiments of FIGs 1 and 2 is shown in FIG. 3. 
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In FIG. 3, the blocker 30 is shown positioned between a hub 
120 and a FCAL target 122. The hub 120 represents the hub 24 of 
the first embodiment in FIG. 1 and it represents the fabric 
switch 110 in the second embodiment of FIG. 2. The FCAL target 
122 represents the private data storage 22 of the FIG. 1 
embodiment and the internal FCAL system 100 in the embodiment of 
FIG. 2. The blocker 30 includes a decoder 32 for receiving the 
serial data on the fibre channel from the hub 120. The serial 
data is converted to parallel words in the decoder 32. The 
parallel data is placed into a regulator 34 and is also directed 
to a compare circuit 36. The compare circuit 3 6 compares the 
parallel data from the decoder 32 and will compare the data 
address received to a group of permitted addresses as shown in 
block 38. If the addresses received by the compare circuit 36 - 
compares to the permitted addresses received from*bl r ock 38, the. 
trigger 40 circuit triggers the regulator 34 to pass the data 
frame to an encoder circuit 42 for transmission to the FCAL 
target 122. Thus if a comparison is made, the trigger 40 allows 
the regulator 34 to pass the data through an encoder 42 and 
permits the access to the FCAL target 122. However, if the 
compare circuit 3 6 does not detect the receipt of a permitted 
address from the block 38, the trigger 40 signals the regulator 
34 to create IDLE characters and access is prevented to the FCAL 
target 122. A more detailed outline of the circuitry of blocker 
3 0 is shown in FIG. 4. 

In FIG. 4 further details of the blocker 30 is shown. The 
fibre channel address blocker 30 is built including three primary 
sections. A transmit/receive section includes a 

serializer/deserializer (SERDES) chip shown as a serial parallel 
deserializer 50 and a parallel to serial serializer 52 together 
with a decoder 54 and an encoder 56. The deserializer 50 
receives serial data along a fibre channel 58 and converts the 
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serial data into ten bit parallel words. The parallel words 
from the deserializer 50 are directed to the decoder 54 which 
decodes the ten bit words and packages them in groups of four as 
32 -bit words with a parity bit for each byte of the word. These 
5 32-bit words are characterized as frame data and include control 
characteristics that are received within the most significant 
bits of the 32-bit words. The decoder 54 and the encoder 56 are 
typically a TQ9303 chip. 

The output of the decoder 54, the frame data comprising 
10 32-bit parallel words, are directed to a data first in/first out 
block, the data FIFO 68. The data FIFO 68 is the second primary 
section of the fibre channel address blocker 30. The data FIFO 
O 68 is 37 bits wide, 32 bits of data, 4 bits of parity and one bit 
.JTI which carries the control signal so that each frame word can be 
■ ff5 tracked as data or : control.. The remaining- primary . section of the 
Zi blocker 30 is the control logic section which includes a compare 
V #1 60, a compare #2 circuit 62, an AND gate 66 and a multiplexor 
'i~ 70. The blocker 30 also includes a target address store 72 and an 
y allowed source addresses store 74. An IDLE character generator 
76 is included for directing IDLE characters into the system as 
+• needed to block the access to the data of the FCAL target 122. In 
sjg FIG. 4, serial data transfer is represented by a thin line, and 
parallel data transfer is represented by a bold line. 

As serial data is received along the fibre channel 58 from 
25 the hub 120, it is directed to the deserializer 50 and the 

decoder 54 where the data is converted into parallel data and 
moved into the first location of the data FIFO 68. The first 
FIFO location is called the source address S Addr 78. When the 
next clock cycle occurs, the first data word is shifted into the 
30 second FIFO location, the destination identification D Addr 80. 

A new word is shifted into the first FIFO location S Addr 78. At 
the next clock cycle, the first word is shifted into the second 
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FIFO location, a new word is shifted into the first FIFO location 
and the second word is converted into a third FIFO location 
called the start of frame SOF 82. The shifting of the data 
through the data FIFO 68 continues as long as the link to the 
5 fibre channel 58 is operational with all data and control words 
moving through the data FIFO 68 . The data FIFO 68 and its 
control logic are contained within an Altera FLEX 10K field 
programmable logic array (FPGA) . The control logic contains a 
bank of 24-bit registers at which the target addresses and their 
10 corresponding allowed initiator addresses are stored. 

When a start of frame character word is detected in a data 
FIFO 68 at SOF 82, the data FIFO 68 is indicating that a new data 
Q frame is being received. The start of frame signal is directed 
■Tfi ' ''to the compare #1 circuit 60. The data word in the second cell, 

: -Li 

IH5 the D Addr 80 contains the frame.^type within the routing control 

field and the destination identification data. The frame data 
Cn from the D Addr 80 is directed to the input of the compare 60. 
; w If the frame is determined to be a FC-4 device data frame, the 
O compare 60 compares the destination identification to the target 
3D address from the target address store 72 stored in the register 
-F bank in the control logic section of the blocker 30. The next 
[% 32 -bit frame word is now contained in the first location of the 
data FIFO 68, the S Addr 78 FIFO location. This frame word 
contains the 24-bit source address and the output of this data 
25 FIFO 68 location, the S Addr 78 location, is directed to the 
compare 2 circuit 62 . The compare 62 of the control logic 
section compares the source address to the allowed addresses as 
contained in the allowed address store 74. If the destination 
address from location 80 of the data FIFO 68 is found to match a 
30 target address from the target address store 72, the compare #1 
circuit 60 permits a comparison in the compare #2 circuit 62 of 
the source address from the FIFO location 78 to the allowed 
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addresses from the allowed address store 74. If a match is 
found, the compare 62 of the control logic allows the frame data 
to continue through the data FIFO 68 for transmittal via the Mux 
70 to the FCAL target 122. If the destination address from the 
5 FIFO location 80 of the data FIFO 68 is not found in the list of 
target addresses from the target address store 72, the frame is 
allowed to pass through the data FIFO 68, the encoder 56 and the 
serializer 52, and is transmitted to the FCAL target 122. 

If a match is found for the destination address from the 
10 FIFO location 80 in the compare #1 circuit 60, but the source 

address from the FIFO location 78 is not on the list of allowed 
addresses from the allowed address store 74, then the compare #2 
D circuit 62 along the NOT line activates an AND gate 66 which 
{7= * permits the transmission of IDLE- characters from the IDLE 
IH5 character generator 76 to be transmitted through the Mux 70, the 
Z\ encoder 56, and the serializer 52, to FCAL target 122 via fibre 
^ 84. The control logic of the blocker 30 asserts the IDLE 
'~ characters, the IDLE characters in turn cause the encoder 56 to 
O ignore the transmit data inputs and to transmit the IDLE 
==§Q characters until an end of frame character is detected in the 
-~F last FIFO location of the data FIFO 68. This action causes the 
,g data frames to apparently disappear. 

If the start of frame signal from FIFO location 82 activates 
the compare #1 circuit 60 and the destination identification from 
25 FIFO location 80 matches an address from the target address store 
72, the compare #1 circuit 60 activates the compare #2 circuit 
62. The activation of the compare #2 circuit 62 causes the 
comparison of the source address from FIFO location 78 to be 
compared with the allowed addresses from the allow address store 
30 74 and if again the source address is in the allowed addresses, 
the NOT line from the compare #2 circuit 62 is directed to the 
AND gate 66 which allows the transmittal of the data from the 
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data FIFO 68 to the FCAL target 122 via the encoder 56 and the 
serializer 52. 

The generation of the IDLE characters causes the frames to 
"disappear", in reality the data frames are replaced by IDLE 
characters. It should be understood that data frames could be 
status frames or command frames, that is, any frame that could be 
a Level FC4 frame. 

The control logic section of the blocker 3 0 is described as 
particular types of gates and blocks of circuitry to compare 
address data signals but it should be understood that the control 
logic described in FIG. 4 is representative of operational steps 
and should not be limited to the actual logic detail described in 
FIG. 4. Thus according to the invention, the blocker 30 accepts 
serial data from a fibre channel, converts the serial data to a . 
parallel data and senses the frame words of the parallel data in., 
order to detect a start of frame signal which then permits the 
comparison of the destination identification signal to the target 
address and the comparison of the source address from the 
incoming data to allowed addresses stored within the blocker 30. 
If the source address is one of the allowed addresses, the 
request for data is continued to the FCAL target 122 via the 
encoder and serializer. 

As shown in FIG. 4, the blocker 3 0 through its control logic 
section compares the serialized data from the fibre channel 58 
which has been converted to parallel data and transmitted to data 
FIFO 68, senses a start of frame data which then permits a 
comparison of the destination identification to the target 
address and a comparison of the source address to the addresses 
permitted access to the FCAL target 122. If the destination 
address has sensed and location 80 of data FIFO 68 is found to 
match the target address from the target address store 72 then 
the control logic compares the source address to the list of 
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allowed addresses from the allowed address store 74. If a match 
is found with the list of allowed addresses, the control logic 
allows the data frame to continue through the data FIFO 68 for 
transmission to the FCAL target 122. If a match is found for the 
destination address but the source address is not on the allowed 
list of addresses from the allowed address store 74, then the 
control logic causes the IDLE character generator to generate 
IDLE characters to the FCAL target 122. The IDLE characters are 
generated and transmitted until an end of frame character is 
detected in the last location of the data FIFO 68. This action 
essentially causes the frames of data to disappear by being 
substituted by IDLE characters. The data frames that travel 
through the data FIFO 68 and are not blocked are directed to an 
encoder. and a parallel to serial converter to be encoded into the 
serial form for transmission through a fibre channel to the-, 
target 122 . 

The decoder 54 and the encoder 56 are typically TQ9303 
encoder/decoder (ENDEC) chips. The serial parallel deserializer 
50 and the parallel to serial serializer 52 are typically a 
Triquint fibre channel chip set and form the receive/transmit 
section of the blocker 30. The serial to parallel deserializer 
50 is typically a TQ9502 chip which is a serializer/deserializer 
(SERDES) chip. The parallel to serial serializer 52 is typically 
a TQ 9501 serializer chip which converts the parallel words from 
the encoder 56 into a serial stream to be transmitted on the 
fibre channel 84 to the target 122. 

The control logic pseudo code for the control section of the 
blocker 3 0 is as follows. Referring to FIG. 4, if the FIFO 
location 82 is equal to a start of frame (SOF) and the FIFO 
location 78 includes a control signal in the source 
identification that the requesting frame contains an FC4 device 
data frame type; 
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AND 

FIFO location 80 does not contain a destination 
identification that compares to the target address; 
OR 

If FIFO location 82 is equal to a start of frame and FIFO 
location 82 includes a control signal that the requesting device 
contains FC 4 device data frame type and the source address from 
the FIFO location 78 successfully compares to the allowed address 
in the compare #1 60; 

THEN 

Allow access to target until the FIFO location 82 signals an 
end of frame data (EOF) ; 
OTHERWISE 

If the FIFO location 82 is equal to a start of frame (SOF) 
and the FIFO location 80 - includes a control ■ signal: -that the 
requesting device contains FC4 device data frame type; 

AND 

The source address from the FIFO location 7 8 does not 
successfully compare to the allowed addresses; 
THEN ■ 

Assert IDLE characters until the FIFO location 82 signals an 
end of frame (EOF) signal. 

A flowchart for the fibre channel address blocking method 
and process according to the present invention is shown in FIG. 
5. Referring to FIG. 5, a block 2 01 shows that data is received 
from a hub which could be a fibre channel arbitrated loop or a 
fabric switch and directed to a serial to parallel conversion 
such as shown in block 202. The data from the serial to parallel 
conversion block 2 02 is directed to a decode to frame data word 
as shown in a block 204. The parallel data from the frame word 
is then entered into a first in first out (FIFO) circuit as shown 
in a block 206. The next step is a decision block where a start 
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of frame is detected or not as shown in decision block 208. If a 
start of frame word is not detected the NO line is taken to a 
block 210 where a sensing of the FIFO frame word is continued and 
the word is transmitted. If the start of frame word is detected, 
5 the flow continues from decision block 208 along the YES line to 
a block 216 where the data frame type, the target address, and 
the allowed source addresses are presented from the FIFO as 
represented by blocks 216, 218 and 220 respectively. If any of 
the compares fail in decision blocks 216, 218, or 220, the flow 
10 reverts to the start block 200. If all three compares are 
satisfied, that is, that an FC4 device data frame type is 
detected, and the target address matches the destination address 
□ in the FIFO, and the source address is not found on the list of 
iTi ' allowed addresses, then the flow goes to block 222,". and the 
1IT5 multiplexer is switched to transmit IDLE characters. .. 
Z\ The flow then goes to a decision block 224 where the end of 

W frame (EOF) character is detected. If in decision block 224, an 
['~ end of frame character is not detected, then the word is encoded 
D in a block 226, serialized in a block 228, and transmitted to the 

target as hown in a block 230. The flow goes to the decision 
*f; block 224 again to check the next word for the end of frame 
^2 character. If an end of frame (EOF) character is detected, the 
EOF character is encoded in a block 232, serialized in a block 
234, and transmitted to the target via fibre as shown in a block 
25 236. The flow then goes to a block 238, where the multiplexer is 
switched to normal transfer mode, where data from the FIFO is 
transmitted in a normal fashion. The flow then reverts back to 
the START block 200. 

Thus, what has been disclosed in the present invention is a 
30 method, apparatus, and article of manufacture for blocking a 
fibre channel address request wherein the incoming frames are 
inspected and checked for the source and destination addresses. 
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If the address is authorized, the request is completed and the 
frame is transferred to the requesting device. If the address 
detected is from an unconfigured source/destination address, the 
frame is replaced with IDLE characters to prevent any transfer of 
5 unauthorized data to the requester. 

Using the foregoing specification, the invention may be 
implemented as a machine, process, or article of manufacture by 
using standard programming or engineering techniques to produce 
computer software, firmware, hardware, or a combination thereof. 
10 Any resulting programs may be embodied within one or more 

computer usable media such as memory devices or transmitting 
devices, thereby making a computer program product or article of 
□ manufacture according to the invention. As such, the terms 
■ Cfz "article of manufacture" and "computer program product" ,a.s used 
\W in the following claims are intended to: encompass a computer 
Z\ program existing on any memory device or in any transmitting 
yl device. Memory devices include fixed (hard) disk drives, 

diskettes, optical disks, magnetic tape, and semiconductor 
O memories such as ROM, PROM, etc. Transmitting devices include the 
flO internet, electronic bulletin board and message/note exchanges, 
=F telephone/modem-based network communication, hard-wired/cable 
j=i communication network, cellular communication, radio wave 

communication, satellite communication, and other stationary or 
mobile network systems and communication links. A computer 
25 program product as described above may be used by transmitting it 
via any of the foregoing transmitting devices. 

One skilled in the art of computer science will easily be 
able to combine the software created as described with 
appropriate general purpose or special purpose computer hardware 
30 to create a computer system and/or computer subcomponents 

embodying the invention and to create a computer system and/or 


- 17 - 



TU999033 

computer subcomponents for carrying out the method of the 
invention . 

Although the invention is described here and with reference 
to the preferred embodiments, one skilled in the art will readily 
5 appreciate that other apparatus, methods and applications may be 
substituted for those set forth herein without departing from the 
spirit and scope of the present invention. For example, specific 
chips and chips that are described herein together with 
representative logic items. The disclosure of specific items 
10 should not limit the invention and accordingly, the invention 
should only be limited by the claims below. 

O We claim: 

W5 • ■ ' 


3° 


25 


30 


- 18 - 


